Búsqueda Imágenes Maps Play YouTube Noticias Gmail Drive Más »
Iniciar sesión
Usuarios de lectores de pantalla: deben hacer clic en este enlace para utilizar el modo de accesibilidad. Este modo tiene las mismas funciones esenciales pero funciona mejor con el lector.

Patentes

  1. Búsqueda avanzada de patentes
Número de publicaciónUS20040088565 A1
Tipo de publicaciónSolicitud
Número de solicitudUS 10/287,125
Fecha de publicación6 May 2004
Fecha de presentación4 Nov 2002
Fecha de prioridad4 Nov 2002
También publicado comoUS8230497
Número de publicación10287125, 287125, US 2004/0088565 A1, US 2004/088565 A1, US 20040088565 A1, US 20040088565A1, US 2004088565 A1, US 2004088565A1, US-A1-20040088565, US-A1-2004088565, US2004/0088565A1, US2004/088565A1, US20040088565 A1, US20040088565A1, US2004088565 A1, US2004088565A1
InventoresAndrew Norman, John Brawn, John Scrimsher, Jonathan Griffin
Cesionario originalNorman Andrew Patrick, Brawn John Melvin, Scrimsher John P., Jonathan Griffin
Exportar citaBiBTeX, EndNote, RefMan
Enlaces externos: USPTO, Cesión de USPTO, Espacenet
Method of identifying software vulnerabilities on a computer system
US 20040088565 A1
Resumen
A method of identifying a software vulnerability on a computer system is disclosed in which the computer system has software stored thereon and is connected to a management system over a computer network. The method comprises the steps of: applying an interrogation program to the software, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; in the event that the software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived the identification of the computer system; and sending the management information to the management system.
Imágenes(7)
Previous page
Next page
Reclamaciones(27)
What is claimed is:
1. A method of identifying a software vulnerability on a computer system having software stored thereon, the computer system being connected to a management system over a computer network, the method comprising: applying an interrogation program to the software, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; in the event that a software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived the identification of the computer system; and sending the management information to the management system.
2. A method according to claim 1, wherein a plurality of interrogation programs are applied to the computer system, each interrogation program being capable of exploiting a different known software vulnerability if it is present in the software to which the interrogation programs are applied, and wherein in the event that a software vulnerability is exploited by one of the interrogation programs, the method further comprises operating that respective interrogation program to generate a set of management information from which can be derived the identification of the software vulnerability so exploited.
3. A method according to claim 1, wherein the interrogation program is further arranged to remediate the known software vulnerability in response to it being identified.
4. A method of identifying software vulnerabilities in a computer network, the computer network comprising a plurality of computer systems having software stored thereon, a scanning system capable of sending at least one interrogation program to each of the computer systems, the at least one interrogation program being arranged to exploit a known software vulnerability if it is present in the software of the computer systems to which the interrogation program is applied, and a management system, the method comprising:
operating the scanning system to apply the at least one interrogation program to the computer systems thereby to determine whether a known software vulnerability is exploited;
in the event that a known software vulnerability is exploited, operating the interrogation program to generate management information at the computer system on which the known software vulnerability was exploited, the management information at least identifying the computer system on which the known software vulnerability was exploited; and
sending the generated management information to the management system.
5. A method according to claim 4, wherein each computer system has an associated network address and wherein the management information sent to the management system includes the network address of the computer system on which the known software vulnerability was identified.
6. A method according to claim 5, wherein the network address is the IP address of the computer system.
7. A method according to claim 4, wherein the scanning system and the management system are implemented on a single computer system.
8. A method according to claim 4, wherein the at least one interrogation program is further arranged to remediate the known software vulnerability it is arranged to exploit, and wherein in the event that the interrogation program exploits a software vulnerability, the method further comprises operating that interrogation program to remediate said software vulnerability.
9. A method according to claim 8, wherein the management information generated by the at least one interrogation program further comprises information indicative of the remediation operation performed.
10. A method according to claim 8, wherein the remediation operation is partial, and wherein the management information generated by the at least one interrogation program further comprises information indicative of the remediation operation performed and any remediation operation required.
11. A method according to claim 4, wherein in the event that a software vulnerability is exploited on one of the computer systems, the interrogation program further operates to identify viruses present on said computer system, the management information including an identification of the at least one virus so identified.
12. A method according to claim 4, wherein, in response to receiving management information from a computer system indicating the presence of a software vulnerability, the management system retrieves a remediation program appropriate to the known software vulnerability and sends the retrieved remediation program to the computer system on which the software vulnerability was identified.
13. A method according to claim 12, wherein the management system retrieves the remediation program from a database storing a plurality of remediation programs, said retrieved remediation program being selected in accordance with the software vulnerability identified in the management information.
14. A method according to claim 4, wherein the management system disables at least part of the computer network in response to receiving management information indicating the presence of a software vulnerability.
15. A method according to claim 4, wherein the management system sends an alert message to the at least one computer system on which a vulnerability is identified in response to receiving management information indicating the presence of a software vulnerability.
16. A method according to claim 4, wherein the management system is capable of remotely stopping the operation of the at least one interrogation program operating on the computer systems.
17. A method according to claim 1, wherein the interrogation program is a http command.
18. A method of identifying a software vulnerability on a computer system having software stored thereon, the computer system being connected to a management system over a computer network, the method comprising: applying an interrogation program to the software, the interrogation program being capable of (i) exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied and (ii) remediating the known software vulnerability it is arranged to exploit; in the event that a software vulnerability is exploited by the interrogation program, operating the interrogation program to remediate the software vulnerability so exploited and generate a set of management information from which can be derived the identification of the computer system; and sending the management information to the management system.
19. A computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing means so as to identify a software vulnerability on a computer system, the computer program performing the steps of: applying an interrogation program to software stored on the computer system, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; and in the event that the software vulnerability is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived at least the identification of the computer system on which the software vulnerability was exploited, the computer program being capable of sending the generated management information over a computer network.
20. A computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing means so as to identify software vulnerabilities in a computer network to which the processing means is connected, the computer network comprising a plurality of computer systems having software stored thereon, the computer program performing the steps of:
(a) sending at least one interrogation program to each computer system, the at least one interrogation program being arranged to exploit a known software vulnerability if it is present in the software of the computer system to which the interrogation program is applied, and operating the at least one interrogation program to generate management information at the computer system on which a known software vulnerability is exploited, the management information identifying the computer system and the particular software vulnerability present on that computer system; and
(b) receiving management information generated by each interrogation program.
21. A computer program according to claim 20, wherein the computer program is arranged to generate, in accordance with the received management information, a database of computer systems on the computer network which have particular software vulnerabilities.
22. A computer program according to claim 20, wherein the management information includes a respective network address associated with each computer system on which the software vulnerability was identified.
23. A computer program according to claim 22, wherein the network address is the IP address of the respective computer system.
24. A computer program according to claim 20, wherein the at least one interrogation program sent by the computer program is further capable of remediating the software vulnerability it is capable of identifying, and wherein in the event that the interrogation program identifies a software vulnerability, the interrogation program operates to remediate said software vulnerability.
25. A computer program according to claim 20, wherein, in response to receiving management information from an interrogation program indicating the presence of a particular software vulnerability, the computer program receives a remediation program appropriate to the particular software vulnerability and sends said retrieved remediation program to the interrogation program.
26. A computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing mean so as to identify a software vulnerability on a computer system having software stored thereon, the computer program being arranged: to interrogate the software of the computer system to detect the presence of a known software vulnerability if it is present in the software; in the event that a vulnerability is detected, to generate a set of management information from which can be derived the identification of the computer system; and to send the management information to a computer network.
27. A computer network comprising: a scanning system; a management system; and a plurality of computer systems, the scanning system being arranged to send at least one interrogation program to each of the computer systems, the at least one interrogation program being arranged to exploit a known software vulnerability if it is present in the software of a computer system to which the interrogation program is applied, to generate management information in the event that a known software vulnerability is exploited, and to send the generated management information to the management system, the management information identifying the computer system on which the known vulnerability was exploited and the particular software vulnerability present on that computer system.
Descripción
    SUMMARY OF THE INVENTION
  • [0001]
    This invention relates to a method of identifying software vulnerabilities on a computer system. The invention also relates to a method of identifying software vulnerabilities in a computer network comprising a plurality of computer systems.
  • BACKGROUND OF THE INVENTION
  • [0002]
    Computer networks are used in many types of organisation, for example within business, industrial and educational organisations. A computer network typically comprises a number of computer systems interconnected by data communications links. Computer networks allow data to be shared between users of individual organisations, and also between users of different organisations.
  • [0003]
    Computer systems connected to such computer networks operate using software executed on the systems. Such software may contain vulnerabilities which render the software, and computer systems running the software, susceptible to interference by unauthorised means. As will be appreciated by those skilled in the art, a software vulnerability may be considered a characteristic of that software which renders it susceptible to processing operations not intended to be permitted or performed by that software. Examples of software vulnerabilities include software features that enable hackers to manipulate the software in an unauthorised way or features that enable malicious mobile code (worms, executable computer viruses, etc.) to access and/or manipulate the software. Knowledge of a software vulnerability enables the formulation of so-called ‘exploit’ programs which are specifically designed to take advantage of such software vulnerabilities.
  • [0004]
    Taking a well-known example, in July 2001, a computer virus was discovered that exploited a software vulnerability in a particular web server application. The virus was known as the “Code Red” virus. The virus exploited a stack/buffer overflow vulnerability in the indexing system of the web server application and used a specially designed hypertext transfer protocol (http) request that, when applied to the web server application, caused malicious code to take control of the web server. The primary behaviour of the malicious code was to propagate across networks very rapidly, and indeed, it was estimated that the Code Red virus was capable of infecting approximately half a million Internet Protocol (IP) addresses per day. A further effect was to deface web-sites present on the ‘infected’ server.
  • [0005]
    Thus, it will be appreciated that since computer networks facilitate the transfer of data across a large number of computer systems in a relatively short space of time, such vulnerabilities can enable malicious mobile code to propagate rapidly across large network areas. The costs involved in rectifying ‘infected’ systems can be very large and it follows that early identification of such vulnerabilities is important so that appropriate remedial action can be taken before the vulnerability is exploited.
  • [0006]
    A conventional method of determining whether computer systems on a network contain vulnerabilities is to perform a scan of Internet Protocol (IP) addresses on the network to identify the software programs present on computer systems having those IP addresses. The result is a list of IP addresses and associated software programs (including their version number). This information is collected centrally, e.g. by an organisation's IT department, and compared with a central database of known vulnerabilities associated with the identified software versions. It is then the task of the IT department to manually identify the physical machine/user from the IP addresses. This can be a difficult, time-consuming and costly task since the allocation of IP addresses does not necessarily correspond to the physical arrangement of computer systems, and the same IP address can even be assigned to different machines at different times. The task of transporting the appropriate remedy, e.g. a software ‘patch’, to the affected computer system or user usually involves some manual element. Once the computer system or user is identified, this process may involve sending an email to the user informing them that they themselves need to apply the patch and where the patch is stored. It is then up to the user to effect the remedy in their own time.
  • [0007]
    It will be appreciated that this conventional method relies heavily on the accuracy of the information in the database which relates known vulnerabilities to identified software versions. Inaccurate information in the database can result in no vulnerability being indicated where, in fact, one exists. Alternatively, a vulnerability could be indicated when one does not exist. As will be appreciated from the above, the remediation method is also slow and can leave computer systems susceptible to virus attacks.
  • [0008]
    It is an object of the present invention to provide an improved method of identifying software vulnerabilities on a computer system, and an improved method of identifying software vulnerabilities in a computer network. It is also an object of the invention to provide an improved method of remediating identified software vulnerabilities.
  • SUMMARY OF THE INVENTION
  • [0009]
    According to a first aspect of the invention, there is provided a method of identifying a software vulnerability on a computer system having software stored thereon, the computer system being connected to a management system over a computer network, the method comprising: applying an interrogation program to the software, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; in the event that the software vulnerability is exploited by the interrogation program, operating the interrogation program to generate management information from which can be derived the identification of the computer system; and sending the management information to the management system.
  • [0010]
    The method provides for accurate determination of whether or not a software vulnerability is present on the software of a computer system. By interrogating the software using a program capable of exploiting a known software vulnerability, it is possible to determine accurately whether that software vulnerability is present from the result of the interrogation. The result of the interrogation will generate management information from which can be derived an indication of the computer system, this information then being sent to a management system over a network connection.
  • [0011]
    The interrogation program will be some form of code, at least part of which is able to exploit a known vulnerability. For example, the interrogation program may simply be embodied in a URL or ‘http’ request. Alternatively, the interrogation program may be an executable file, although this is not essential. Other forms of interrogation program can be envisaged.
  • [0012]
    As mentioned previously, a software vulnerability may be considered a characteristic of the software which renders it susceptible to processing operations not intended to be permitted or performed by that software. Examples of software vulnerabilities include software features that enable hackers to manipulate the software in an unauthorised way or features that enable malicious mobile code (worms, executable computer viruses etc.) to access and/or manipulate the software. A buffer overflow attack (which could include a stack overflow attack) is an example of a processing operation which takes advantage of a software vulnerability.
  • [0013]
    Preferably, a plurality of interrogation programs is applied to the computer system, each interrogation program being capable of exploiting a different known software vulnerability if it is present in the software to which the interrogation programs are applied, and wherein, in the event that the software vulnerability is exploited by one of the interrogation programs, the method further comprises operating that respective interrogation program to generate a further set of management information from which can be derived the identification of the software vulnerability so exploited.
  • [0014]
    The interrogation program may further be arranged to remediate the known software vulnerability in response to it being identified. This is preferably performed automatically and electronically using the identity information corresponding to the computer system having the software vulnerability. It is particularly advantageous if the identity information is a network address corresponding to the computer system, e.g. an IP address, so that the management computer can automatically send, or cause to be sent, a remediation program over the network connection to the relevant computer system. This enables rapid remediation of identified software vulnerabilities, which is important for preventing a future ‘attack’ on that vulnerability.
  • [0015]
    According to a second aspect of the invention, there is provided a method of identifying software vulnerabilities in a computer network, the computer network comprising a plurality of computer systems having software stored thereon, a scanning system capable of sending at least one interrogation program to each of the computer systems, the at least one interrogation program being arranged to exploit a known software vulnerability if it is present in the software of the computer systems to which the interrogation program is applied, and a management system, the method comprising: operating the scanning system to apply the at least one interrogation program to the computer systems thereby to determine whether a known software vulnerability is exploited; in the event that a known software vulnerability is exploited, operating the interrogation program to generate management information at the computer system on which the known software vulnerability was exploited, the management information at least identifying the computer system on which the known software vulnerability was exploited; and sending the generated management information to the management system.
  • [0016]
    The scanning system may send the or each interrogation program to each computer system concurrently, i.e. in parallel. The scanning may be divided across particular address ranges, e.g. IP address ranges, of the computer network.
  • [0017]
    Each computer system may have an associated network address and the management information sent to the management system may include the network address of the computer system on which the known software vulnerability was identified. The network address may be the IP address of the computer system.
  • [0018]
    The scanning system and management system may be implemented on a single computer system. Alternatively, the scanning system and management system may be implemented on separate computer systems.
  • [0019]
    The at least one interrogation program may further be arranged to remediate the known software vulnerability it is arranged to exploit, and in the event that the interrogation program exploits a software vulnerability, the method can further comprise operating that interrogation program to remediate said software vulnerability. In this case, the management information generated by the at least one interrogation program may further comprise information indicative of the remediation operation performed. The remediation operation can be partial, and the management information generated by the at least one interrogation program can further comprise information indicative of the remediation operation performed and any remediation operation required.
  • [0020]
    In the event that a software vulnerability is exploited on one of the computer systems, the interrogation program may further operate to identify viruses present on said computer system, the management information including an identification of the or each virus so identified. Thus, since it is possible that an identified software vulnerability may already have been exploited by malicious code, such as a virus, it may be important to repair any damage done by that code before the actual vulnerability is remediated.
  • [0021]
    In response to receiving management information from a computer system indicating the presence of a software vulnerability, the management system may retrieve a remediation program appropriate to said known software vulnerability and send the retrieved remediation program to said computer system. The management system can retrieve the remediation program from a database storing a plurality of remediation programs, said retrieved remediation program being selected in accordance with the software vulnerability identified in the management information.
  • [0022]
    The management system may be configured to disable at least part of the computer network in response to receiving management information indicating the presence of a software vulnerability.
  • [0023]
    The management system may send an alert message to the or each computer system on which a vulnerability is identified in response to receiving management information indicating the presence of a software vulnerability. Indeed, the interrogation program can also be configured to cause such an alert to be displayed.
  • [0024]
    The management system may remotely stop the operation of the at least one interrogation program operating on the computer systems.
  • [0025]
    According to a third aspect of the invention, there is provided a computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing means so as to identify a software vulnerability on a computer system, the computer program performing the steps of: applying an interrogation program to software stored on the computer system, the interrogation program being capable of exploiting a known software vulnerability if it is present in the software to which the interrogation program is applied; and in the event that the software is exploited by the interrogation program, operating the interrogation program to generate a set of management information from which can be derived at least the identification of the computer system on which the software vulnerability was exploited, the computer program being capable of sending the generated management information over a computer network.
  • [0026]
    According to a fourth aspect of the invention, there is provided computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing means so as to identify software vulnerabilities in a computer network to which the processing means is connected, the computer network comprising a plurality of computer systems having software stored thereon, the computer program performing the steps of: (a) sending at least one interrogation program to each computer system, the at least one interrogation program being arranged to (i) exploit a known software vulnerability if it is present in the software of the computer system to which the interrogation program is applied, and (ii) operate the interrogation program to generate management information at the computer system on which the known software vulnerability is exploited, the management information identifying the computer system and the particular software vulnerability present on that computer system; and (b) receiving management information generated by each interrogation program.
  • [0027]
    The computer program may be arranged to generate, in accordance with the received management information, a database of computer systems on the computer network which have particular software vulnerabilities.
  • [0028]
    The management information received may include a respective network address associated with each computer system on which the software vulnerability was identified. The network address may be the IP address of the respective computer system.
  • [0029]
    The or each interrogation program sent by the computer program may be further capable of remediating the software vulnerability it is capable of identifying, and wherein in the event that the interrogation program identifies a software vulnerability, the interrogation program may operate to remediate said software vulnerability.
  • [0030]
    In response to receiving management information from an interrogation program indicating the presence of a particular software vulnerability, the computer program may operate so as to acquire a remediation program appropriate to the particular software vulnerability and then send said retrieved remediation program to the interrogation program.
  • [0031]
    According to a fifth aspect of the invention, there is provided a computer program stored on a computer usable medium, the computer program comprising computer-readable instructions arranged to operate under the control of a processing mean so as to identify a software vulnerability on a computer system having software stored thereon, the computer program being arranged: to interrogate the software of the computer system to detect the presence of a known software vulnerability if it is present in the software; in the event that a vulnerability is detected, to generate a set of management information from which can be derived the identification of the computer system; and to send the management information to a computer network.
  • [0032]
    According to a sixth aspect of the invention, there is provided a computer network comprising: a scanning system; a management system; and a plurality of computer systems, the scanning system being arranged to send at least one interrogation program to each of the computer systems, the at least one interrogation program being arranged to exploit a known software vulnerability if it is present in the software of a computer system to which the interrogation program is applied, to generate management information in the event that a known software vulnerability is exploited, and to send the generated management information to the management system, the management information identifying the computer system on which the known vulnerability was exploited and the particular software vulnerability present on that computer system.
  • [0033]
    The invention will now be described, by way of example, with reference to the drawings.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • [0034]
    In the drawings:
  • [0035]
    [0035]FIG. 1 is a schematic diagram of a computer network;
  • [0036]
    [0036]FIG. 2 is a block diagram of a computer system connected to the computer network represented in FIG. 1;
  • [0037]
    [0037]FIG. 3 shows a modified part of the computer network represented in FIG. 1;
  • [0038]
    [0038]FIG. 4 is a block diagram representing a database for storing so-called ‘exploit programs’;
  • [0039]
    [0039]FIG. 5 is a block diagram indicating a design process for generating an exploit program;
  • [0040]
    [0040]FIG. 6 is a flow chart showing the operating steps of computer software running on a management computer of the computer network represented in FIG. 1;
  • [0041]
    [0041]FIG. 7 is a schematic diagram of the computer network represented in FIG. 1 in the case that a software vulnerability is present on a computer system connected to the network;
  • [0042]
    [0042]FIG. 8 is a flow chart showing the operating steps of an exploit program used by the computer software running on the management computer;
  • [0043]
    [0043]FIG. 9 is a block diagram representing a database for storing modified exploit programs for use in a method according to a further embodiment of the invention;
  • [0044]
    [0044]FIG. 10 is a flow chart showing the operating steps of a modified exploit program;
  • [0045]
    [0045]FIG. 11 is a block diagram representing a database for storing modified exploit programs for use in a method according to a yet further embodiment of the invention; and
  • [0046]
    [0046]FIG. 12 is a flow chart showing the operating steps of computer software running on the management computer of the computer network, the management computer operating according to the yet further embodiment of the invention.
  • DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT
  • [0047]
    Referring to FIG. 1, a computer network 1 has first, second and third computer systems 3, 5, 7, and a management computer 11. The management computer 11 is typically located remotely from the first to third computer systems 3, 5, 7 and may be operated under the control of IT department staff. Indeed, in this example, the remote location of the management computer 11 is represented by the dotted line 13. Although only first to third computer systems 3, 5, 7 are shown, it will be appreciated that many other computer systems can be connected to the computer network 1, either directly, or by means of other network links 15. Each of the first to third computer systems 3, 5, 7 has a number of software programs stored thereon which are executed by processing means of each respective computer system. For example, each of the first to third computer systems 3, 5, 7 may be provided with an operating system, a word processing package, and a web server which enables connection to the Internet.
  • [0048]
    [0048]FIG. 2 is a generalised block diagram showing the functional elements of the first computer system 3, although it should be understood that the second and third computer systems 5, 7 have the same elements. Referring to FIG. 2, the first computer system 3 comprises a processing means 21, a visual display unit (VDU) 23, and input means 25. The processing means 21 is programmed with a network address in the form of an IP address. It will be appreciated that the IP address can be used by computer systems on the computer network 1, including the management computer 11, to communicate with the first computer system 3. Indeed, the IP address enables the management computer 11 to connect with the first computer system 3 without requiring knowledge of its physical location. The processing means of the second and third computer systems 5, 7 are programmed with different respective IP addresses. As mentioned previously, it is possible for the same IP address to be assigned to different machines at different times.
  • [0049]
    The function of the management computer 11 is at least to identify software vulnerabilities present on the software programs running on the first to third computer systems 3, 5, 7. In a further embodiment, described below, the management computer 11 is also arranged to remediate, i.e. mitigate, the or each software vulnerability it is able to identify.
  • [0050]
    As will be discussed further below, the management computer 11 is specifically configured to identify a plurality of known software vulnerabilities. In this respect, it will be appreciated that when a software vulnerability is initially discovered, which may be as a result of legitimate investigations by software engineers, details of the software vulnerability may be made available so that an appropriate remediation operation can be applied or developed to mitigate the vulnerability, for example by removing the vulnerability or at least making it difficult to take advantage of the vulnerability. Knowledge of the software vulnerability also enables the formulation of programs which are specifically designed to take advantage of, or exploit, the known vulnerability thereby to enable unauthorised operations to be performed on the software, e.g. by means of a virus attack. Indeed, a software vulnerability may only be discovered by the public at large when such a virus attack is discovered on a computer system. In the embodiments described herein, such an exploitation method is used to identify whether or not that software vulnerability is present.
  • [0051]
    The management computer 11 shown in FIG. 1 is a single processing system that performs two main functions. One function is that of scanning each of the first to third computer systems 3, 5, 7 in order to identify whether a software vulnerability is present in the software running thereon. A second function is that of collecting management information, at least from those computer systems on which a software vulnerability is discovered. In functional terms, therefore, the management computer 11 may be considered a single processing system operating a scanning system and a data management system. In an alternative arrangement, indicated in FIG. 3, separate first and second processing means 17, 19 may be used, the first processing means being arranged to perform the scanning operation and the second processing means being arranged to collect the management information.
  • [0052]
    As mentioned above, the management computer 11 is arranged to scan each of the first to third computer systems 3, 5, 7 in order to identify whether a software vulnerability is present. This scanning operation is performed by accessing a database of interrogation programs, hereafter referred to as “exploit programs”, and applying those exploit programs to the first to third computer systems 3, 5, 7. FIG. 4 shows an exemplary database 29 of exploit programs. The database 29 can be stored internally within the management computer 11, or externally from the management computer (assuming that appropriate security measures had been taken). As will be seen, in this case, the database 29 stores four different exploit programs, referred to as E1-E4, each of which is specifically designed to exploit a different known software vulnerability Vn, labelled V1-V4 respectively. The presence of one of the software vulnerabilities V1-V4 on any of the first to third computer systems 3, 5, 7 will be identified in the event that one of the exploit programs E1-E4 successfully exploits software on one of the computer systems. When this occurs, the ‘successful’ exploit program on the exploited computer system to generate management information which is then sent back to the management computer 11 over the computer network 1. The management information will indicate the identity of the computer system on which the vulnerability was exploited, for example by using the IP address of that computer system. The management computer 11 is then able to establish which of the first to third computer systems 3, 5, 7, if any, has particular software vulnerabilities.
  • [0053]
    The management computer 11 may scan each of the first to third computer systems 3, 5, 7 concurrently, i.e. so that the exploit programs E1-E4 are applied to each of the first to third computer systems in parallel. In computer networks having much larger numbers of computer systems, it may be appropriate to divide the scanning process in a controlled manner, for example by limiting the scanning operation to particular ranges of IP address.
  • [0054]
    As already mentioned, each exploit program E1-E4 is designed based on knowledge of the particular software vulnerability it is required to exploit.
  • [0055]
    One method of designing an exploit program is to identify an already-available program, such as a computer virus, which is known to be capable of exploiting the software vulnerability. The malicious program is then reverse engineered to identify an “exploit part” of the program, which allows the software vulnerability to be accessed, and a “malicious part” of the program, which performs the malicious operation on the accessed software. The “malicious part” is then discarded and replaced with a “management part” which performs the task of generating the management information for sending back to the management computer 11. The “management part” can be designed to perform a number of useful management tasks and has to be carefully coded so as not to cause problems once the exploit program has accessed the software. For example, the “management part” will not usually allow the exploit program to propagate to further computer systems which may cause problems if the propagation becomes uncontrollable. As will be discussed further below, the “management part” can also include remediation means to remove or mitigate the exploited software vulnerability. FIG. 5 illustrates the method described above wherein a malicious program 33 is reverse engineered to identify the “exploit part” and the “malicious part”, the former being used in an exemplarily exploit program 35 along with a “management part”.
  • [0056]
    A further method of designing an exploit program is simply to start from first principles. Once it is understood how and why a software vulnerability makes the software susceptible to an attack, a computer program is designed which is able take advantage of the vulnerability. This method is generally more time consuming.
  • [0057]
    The general operation of the management computer 11 will now be described with reference to the flow chart of FIG. 6 and the schematic network diagram of FIG. 7 . The different steps indicated in the flow chart of FIG. 6 may be implemented in a computer program configured to run on the management computer 11.
  • [0058]
    In a first step 39, each of the first to third computer systems 3, 5, 7 is scanned by the management computer 11 by means of it applying each exploit program E1-E4 to software running on those computer systems. The general operation of each exploit program E1-E4 will be described further below. In a second step 41, the management computer 11 waits for receipt of any management information which is generated by each exploit program E1-E4 in order to indicate that it has exploited a particular software vulnerability. Upon receiving such management information, in a third step 43, processing of the received management information is performed to identify which of the first to third computer systems 3, 5, 7 have particular software vulnerabilities. In a final step 45, management tasks are performed based on knowledge of the management information processed in the third step 43. Referring to FIG. 6, in the exemplary case shown, a software vulnerability V1 is identified on the first computer 3 by the exploitation program E1 and so management information is generated at the first computer 3 and sent back to the management computer 11. Since the management information is returned by the exploitation program E1 and will indicate that it is sent from the first computer 3, the management computer 11 will determine that the first computer has the software vulnerability V1.
  • [0059]
    The management tasks performed in step 45 may include sending a message to a user of the relevant computer system, informing them of the presence of the vulnerability, and indicating further action that should be taken. This may involve notifying the user that an appropriate remediation program can be applied and where the remediation program is stored. Alternatively, the remediation program can be sent to the user as an attachment to an email message. The management operation may involve shutting the relevant computer system down, or even disabling part of the computer network to which the relevant computer system is connected. Given that a software vulnerability has been identified, it may be useful to apply a virus-checking program to the relevant computer system so as to determine whether that computer system has already been exploited by malicious code.
  • [0060]
    The general operation of a first one of the exploit programs, E1, will now be described with reference to the flow chart of FIG. 8. It will be appreciated that the second to fourth exploit programs E2-E4 will operate in substantially the same way. As with the schematic network diagram of FIG. 7, the first computer 3 is assumed to have the software vulnerability V1 which can be exploited by the first exploit program E1.
  • [0061]
    In a first step 49, the first exploit program E1 is applied to each of the first to third computer systems 3, 5, 7. In a second step, 51, the first exploit program E1 attempts to access software running on each of the first to third computer systems 3, 5, 7 by means of the software vulnerability V1. In the event that the first exploit program E1 is successful, as will be the case with the first computer 3, a third step 53 is entered whereby a “management part” of the exploit program runs on the accessed software of the first computer 3 to generate management information M1 for sending back to the management computer 11. In a fourth step 55, the generated management information M1 is sent to the management computer 11. The operation of the management computer 11 thereafter has already been described above with reference to FIG. 7. In the event that the first exploit program E1 does not successfully access the software, as will be the case with the second and third computer systems 5, 7, the exploit program ends.
  • [0062]
    The “management part” of the exploit program E1 is arranged to generate at least an indication of the ‘relevant’ computer system on which the vulnerability V1 is present. In this embodiment, the IP address of the first computer system 3 is used, although other identification means could be used. Use of the IP address is particularly advantageous since the management computer 11 does not need to know the physical location of the first computer system 3 or even the identity of the user operating the first computer system. Using the IP address enables data communications between the management computer 11 and the first computer 3 over the computer network 1. Thus, the management computer 11 can establish contact with the first computer 3 and perform any management tasks deemed necessary. As mentioned above, these management tasks may involve alerting a user that a vulnerability exists, or even shutting that computer system down. This is done electronically and so very rapidly.
  • [0063]
    The “management part” of the exploit program E1 may further be arranged to generate other forms of management information. This information may give further details on the vulnerability so identified, or whether the computer system is also infected by malicious code, such as a worm or virus. It may also be desirable to know the time when the software vulnerability was identified. The management computer 11 may then send a message to the relevant computer system giving users thereof a finite time limit from the ‘time of identification’ to remedy the vulnerability before the computer system is shut down. The “management part” may attempt to discover likely users of the relevant computer system so that an email can be sent to those users' own email addresses. This may be performed by the management part interrogating log-in files and/or email in-boxes. The “management part” may also assess the hardware and software configurations of the relevant computer system to assess any damage that has already been done.
  • [0064]
    Second and third preferred embodiments of the invention will now be described with reference to FIGS. 9 to 12. In these embodiments, the management computer 11 is further configured to apply remediation means to those computer systems on which a software vulnerability is identified. As mentioned above, knowledge of the existence of a software vulnerability enables the design of software for remediating that vulnerability. Remediation may involve attempting to remove the vulnerability, either fully or partially, or at least changing the vulnerability in some way so that the task of exploiting it is made more difficult. Partial remediation may be preferable if the complete remediation requires a relatively large piece of software that cannot be transported efficiently over the computer network 1. Partial remediation may also be preferable if complete remediation requires actions that cannot be reliably carried out without some form of human interaction
  • [0065]
    In the second preferred embodiment, each exploit program E1-E4 in the database 29 shown in FIG. 4 is modified so that an additional “remediation payload” part R1-R4 is included. R1 is arranged to remediate the software vulnerability which can be exploited by E1, R2 is arranged to remediate the software vulnerability which can be exploited by E2, and so on. A database 29′ storing the modified exploitation programs E1′-E4′ is represented in FIG. 9.
  • [0066]
    The general operation of a first one of the modified exploit programs, E1′, will now be described with reference to the flow chart of FIG. 10. It will be appreciated that the second to fourth modified exploit programs E2′-E4′ will operate in substantially the same way as E1′. As with the case shown in FIG. 6, the first computer 3 is assumed to have the software vulnerability V1.
  • [0067]
    In a first step 61, the first exploit program E1′ is applied to each of the first to third computer systems 3, 5, 7. In a second step, 63, the first exploit program E1′ attempts to access software running on each of the first to third computer systems 3, 5, 7 by means of a known software vulnerability V1. In the event that the exploit part of the first exploit program E1′ is successful, as will be the case with the first computer 3, a third step 65 is entered whereby the remediation payload R1 of the first exploit program E1′ is executed on the accessed software so as to run a remediation operation. In a fourth step 67, the “management part” of the exploit program E1′ runs on the accessed software of the first computer 3 to generate management information M1′ for sending back to the management computer 11. In a fifth step 69, the generated management information M1′ is sent to the management computer 11. The management information M1′ may include details of the remediation operation performed. In the event that the first exploit program E1′ does not successfully access the software, as will be the case with the second and third computer systems 5, 7, the exploit program ends.
  • [0068]
    A third preferred embodiment of the invention will now be described with reference to FIGS. 11 and 12 This third embodiment is similar to the second embodiment in that the management computer 11 is configured to apply remediation means to those computer systems on which a software vulnerability is identified. However, rather than including an appropriate remediation payload with the sent exploit program, a remediation payload is sent separately to one or more of the first to third computer systems 3, 5, 7 in accordance with the software vulnerabilities identified thereon. To facilitate this, each exploit program E1-E4 is associated with a respective remediation payload R1-R4. As with the second embodiment, R1 is arranged to remediate the software vulnerability which can be exploited by E1, R2 is arranged to remediate the software vulnerability which can be exploited by E2, and so on. An exemplary database 73 storing the exploit programs and their associated payloads is represented in FIG. 11.
  • [0069]
    In this case, remediation of an identified software vulnerability is effected by means of the management computer 11 fetching the appropriate remediation payload in accordance with the vulnerability identified in the management information. FIG. 12 shows the steps involved in performing the remediation operation, taking the situation shown in FIG. 7 as an example. The steps illustrated in FIG. 7 may be considered an example of a management task performed in the fourth step 45 of FIG. 6. It is assumed that the management computer 11 has received management information M1 indicating that the first computer system 3 has the software vulnerability V1.
  • [0070]
    In a first step 77, the management computer 11 accesses the database 73 and acquires a copy of the remediation payload R1. In a second step 79, and the remediation payload is sent to the first computer system 3. The remediation payload R1 is applied to the first computer system 3 and executed. In a third step 81 further management, indicative of the remediation operation performed, is sent back to the management computer 11.
  • [0071]
    As mentioned above, with reference to FIG. 3, instead of employing a single management computer 11 to perform the scanning operation and collection of management information, it is possible to use separate first and second processing means 17, 19. In this arrangement, the second processing means 19 acquires the appropriate remediation payload R1 in response to receiving the management information from one of the first to third computer systems 1, 3, 7.
  • [0072]
    When applying the appropriate remediation means to one of the first to third computer systems 1, 3, 7 it is not essential to access the software of the computer system using the software vulnerability so identified. Indeed, any other vulnerability or corporate access agent/backdoor can be used to access the software and remediate the vulnerability so identified.
Citas de patentes
Patente citada Fecha de presentación Fecha de publicación Solicitante Título
US6205552 *31 Dic 199820 Mar 2001Mci Worldcom, Inc.Method and apparatus for checking security vulnerability of networked devices
US6647400 *30 Ago 200011 Nov 2003Symantec CorporationSystem and method for analyzing filesystems to detect intrusions
US6826697 *30 Ago 200030 Nov 2004Symantec CorporationSystem and method for detecting buffer overflow attacks
US6925443 *26 Abr 20002 Ago 2005Safeoperations, Inc.Method, system and computer program product for assessing information security
US6988208 *16 Jul 200217 Ene 2006Solutionary, Inc.Method and apparatus for verifying the integrity and security of computer networks and implementing counter measures
US6996843 *30 Ago 20007 Feb 2006Symantec CorporationSystem and method for detecting computer intrusions
US7013395 *13 Mar 200114 Mar 2006Sandra CorporationMethod and tool for network vulnerability analysis
US7031945 *24 Jul 200118 Abr 2006Donner Irah HSystem and method for reallocating and/or upgrading and/or rewarding tickets, other event admittance means, goods and/or services
US7032114 *30 Ago 200018 Abr 2006Symantec CorporationSystem and method for using signatures to detect computer intrusions
US7065657 *30 Ago 200020 Jun 2006Symantec CorporationExtensible intrusion detection system
US20010034847 *27 Mar 200125 Oct 2001Gaul,Jr. Stephen E.Internet/network security method and system for checking security of a client from a remote facility
US20030084320 *31 Oct 20011 May 2003Tarquini Richard PaulNetwork, method and computer readable medium for distributing security updates to select nodes on a network
Otras citas
Referencia
1 *Jiwnani, Kanta. Zelkowitz, Marvin. Maintaining Software with a Security Perspective. International Conference on Software Maintenance. Pub. Date: 2002. Relevant Pages: 194-203. Found on the World Wide Web at: http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=1167766
Citada por
Patente citante Fecha de presentación Fecha de publicación Solicitante Título
US735353916 Ene 20031 Abr 2008Hewlett-Packard Development Company, L.P.Signal level propagation mechanism for distribution of a payload to vulnerable systems
US739534116 Ago 20041 Jul 2008Fiberlink Communications CorporationSystem, method, apparatus and computer program product for facilitating digital communications
US769433720 Sep 20046 Abr 2010Fortinet, Inc.Data structure for vulnerability-based remediation selection
US771212824 Jul 20024 May 2010Fiberlink Communication CorporationWireless access system, method, signal, and computer program product
US772558918 Abr 200825 May 2010Fiberlink Communications CorporationSystem, method, apparatus, and computer program product for facilitating digital communications
US777484823 Jul 200410 Ago 2010Fortinet, Inc.Mapping remediation to plurality of vulnerabilities
US817155523 Jul 20041 May 2012Fortinet, Inc.Determining technology-appropriate remediation for vulnerability
US820077330 Sep 200212 Jun 2012Fiberlink Communications CorporationClient-side network access policies and management applications
US823470620 Jun 200731 Jul 2012Microsoft CorporationEnabling access to aggregated software security information
US825065128 Jun 200721 Ago 2012Microsoft CorporationIdentifying attributes of aggregated data
US8266699 *1 Jul 200411 Sep 2012SecurityProfiling Inc.Multiple-path remediation
US830219728 Jun 200730 Oct 2012Microsoft CorporationIdentifying data associated with security issue attributes
US8336103 *21 Jun 201018 Dic 2012Fortinet, Inc.Data structure for policy-based remediation selection
US8341691 *17 Dic 200925 Dic 2012Colorado Remediation Technologies, LlcPolicy based selection of remediation
US839299511 Ene 20055 Mar 2013Hewlett-Packard Development Company, L.P.Network management
US856113414 Dic 201215 Oct 2013Colorado Remediation Technologies, LlcPolicy-based selection of remediation
US856119722 Abr 201015 Oct 2013Fortinet, Inc.Vulnerability-based remediation selection
US86357024 Abr 201221 Ene 2014Fortinet, Inc.Determining technology-appropriate remediation for vulnerability
US895503816 Ago 201210 Feb 2015Fiberlink Communications CorporationMethods and systems for controlling access to computing resources based on known security vulnerabilities
US898464428 Sep 201417 Mar 2015Securityprofiling, LlcAnti-vulnerability system, method, and computer program product
US910043128 Sep 20144 Ago 2015Securityprofiling, LlcComputer program product and apparatus for multi-path remediation
US911706921 Dic 201325 Ago 2015Securityprofiling, LlcReal-time vulnerability monitoring
US911870828 Sep 201425 Ago 2015Securityprofiling, LlcMulti-path remediation
US911870928 Sep 201425 Ago 2015Securityprofiling, LlcAnti-vulnerability system, method, and computer program product
US911871029 Sep 201425 Ago 2015Securityprofiling, LlcSystem, method, and computer program product for reporting an occurrence in different manners
US911871129 Sep 201425 Ago 2015Securityprofiling, LlcAnti-vulnerability system, method, and computer program product
US914727120 Jun 200729 Sep 2015Microsoft Technology Licensing, LlcGraphical representation of aggregated data
US915452313 Feb 20156 Oct 2015Fortinet, Inc.Policy-based selection of remediation
US922568616 Mar 201529 Dic 2015Securityprofiling, LlcAnti-vulnerability system, method, and computer program product
US934901316 Ago 201324 May 2016Fortinet, Inc.Vulnerability-based remediation selection
US935075228 Sep 201424 May 2016Securityprofiling, LlcAnti-vulnerability system, method, and computer program product
US939202418 Ago 201512 Jul 2016Fortinet, Inc.Policy-based selection of remediation
US9489529 *27 Ago 20128 Nov 2016Stewart A. BakerData security system
US960255016 May 201621 Mar 2017Fortinet, Inc.Policy-based selection of remediation
US960899710 Feb 201528 Mar 2017International Business Machines CorporationMethods and systems for controlling access to computing resources based on known security vulnerabilities
US20040088581 *16 Ene 20036 May 2004Brawn John MelvinSignal level propagation mechanism for distribution of a payload to vulnerable systems
US20050022012 *30 Sep 200227 Ene 2005Derek BluestoneClient-side network access polices and management applications
US20050044389 *1 Jul 200424 Feb 2005Oliphant Brett M.Multiple-path remediation
US20050081045 *16 Ago 200414 Abr 2005Fiberlink Communications CorporationSystem, method, apparatus and computer program product for facilitating digital communications
US20050086492 *16 Ago 200421 Abr 2005Fiberlink Communications CorporationSystem, method, apparatus and computer program product for facilitating digital communications
US20050086510 *16 Ago 200421 Abr 2005Fiberlink Communications CorporationSystem, method, apparatus and computer program product for facilitating digital communications
US20050172019 *11 Ene 20054 Ago 2005Williamson Matthew M.Network management
US20050254651 *24 Jul 200217 Nov 2005Porozni Baryy IWireless access system, method, signal, and computer program product
US20060018485 *14 Abr 200526 Ene 2006Diefenderfer Kristopher GSecure communication protocol
US20060021051 *23 Jul 200426 Ene 2006D Mello KurtDetermining technology-appropriate remediation for vulnerability
US20060075503 *13 Sep 20056 Abr 2006Achilles Guard, Inc. Dba Critical WatchMethod and system for applying security vulnerability management process to an organization
US20060259779 *1 Jul 200416 Nov 2006Securityprofiling, Inc.Multiple-path remediation
US20070055752 *8 Sep 20058 Mar 2007FiberlinkDynamic network connection based on compliance
US20070113100 *1 Jul 200417 May 2007Securityprofiling, Inc.Multiple-path remediation
US20070143827 *13 Jun 200621 Jun 2007FiberlinkMethods and systems for intelligently controlling access to computing resources
US20070143851 *13 Jun 200621 Jun 2007FiberlinkMethod and systems for controlling access to computing resources based on known security vulnerabilities
US20080065646 *20 Jun 200713 Mar 2008Microsoft CorporationEnabling access to aggregated software security information
US20080222696 *18 Abr 200811 Sep 2008Fiberlink Communications CorporationSystem, Method, Apparatus, and Computer Program Product for Facilitating Digital Communications
US20090007271 *28 Jun 20071 Ene 2009Microsoft CorporationIdentifying attributes of aggregated data
US20100138897 *17 Dic 20093 Jun 2010Secure Elements, Inc.Policy-based selection of remediation
US20100199353 *22 Abr 20105 Ago 2010Fortinet, Inc.Vulnerability-based remediation selection
US20100257585 *21 Jun 20107 Oct 2010Fortinet, Inc.Data structure for policy-based remediation selection
US20130097696 *27 Ago 201218 Abr 2013Stewart A. BakerData security system
Clasificaciones
Clasificación de EE.UU.726/22
Clasificación internacionalH04L29/06
Clasificación cooperativaH04L63/1433
Clasificación europeaH04L63/14C
Eventos legales
FechaCódigoEventoDescripción
18 Jun 2003ASAssignment
Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., COLORAD
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD COMPANY;REEL/FRAME:013776/0928
Effective date: 20030131
Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.,COLORADO
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD COMPANY;REEL/FRAME:013776/0928
Effective date: 20030131
23 Oct 2006ASAssignment
Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., TEXAS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:NORMAN, ANDREW PATRICK;BRAWN, JOHN M.;SCRIMSHER, JOHN P.;AND OTHERS;REEL/FRAME:018444/0855;SIGNING DATES FROM 20060522 TO 20060601
Owner name: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P., TEXAS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:NORMAN, ANDREW PATRICK;BRAWN, JOHN M.;SCRIMSHER, JOHN P.;AND OTHERS;SIGNING DATES FROM 20060522 TO 20060601;REEL/FRAME:018444/0855
9 Nov 2015ASAssignment
Owner name: HEWLETT PACKARD ENTERPRISE DEVELOPMENT LP, TEXAS
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.;REEL/FRAME:037079/0001
Effective date: 20151027
29 Dic 2015FPAYFee payment
Year of fee payment: 4